feat: expose image digest in GraphQL

[ybelMekk]

Summary

• expose image digest as a dedicated GraphQL field on ContainerImage
• keep vulnerability lookup semantics for v13s while separating GraphQL image parsing
• update Go and Lua tests to cover tag-only, digest-only, and tag+digest image refs

Testing

• rtk go test ./internal/workload ./internal/vulnerability ✅

[Copilot]

Pull request overview

This PR updates the workload image parsing/model so GraphQL can expose an image digest as a first-class field, while preserving existing vulnerability lookup semantics (v13s) by reusing the same parsing primitive across workload + vulnerability code paths. It also expands unit/integration test coverage for tag-only, digest-only, and tag+digest image references.

Changes:

• Add digest to ContainerImage in the GraphQL schema and Go model, and introduce ParseImageReference to parse tag/digest without conflating them.
• Update vulnerability image splitting/lookup to use the shared workload parser while keeping “default tag to latest” and lookup formatting semantics.
• Extend Go and Lua tests/resources to cover digest-only and nested-path image references (including registries with ports).

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/workload/models.go	Adds Digest to ContainerImage and introduces ParseImageReference/ParsedImageReference for consistent tag+digest parsing.
internal/workload/models_test.go	Expands round-trip and metadata tests for image parsing/ref reconstruction across many reference shapes.
internal/vulnerability/queries.go	Replaces local parsing with workload.ParseImageReference while keeping “tag defaults to latest” behavior.
internal/vulnerability/queries_test.go	Adds test cases for nested-path images (digest-only, tag+digest, registry ports).
internal/vulnerability/fake/fakedata.go	Adjusts fake v13s workload summaries to format image lookup refs correctly with the new parsing semantics.
internal/graph/schema/workloads.graphqls	Adds digest: String to ContainerImage.
internal/graph/gengql/workloads.generated.go	Regenerates gqlgen code to expose ContainerImage.digest.
internal/graph/gengql/root_.generated.go	Regenerates schema/complexity plumbing for the new digest field.
integration_tests/vulnerability_digest_only.lua	New integration test asserting digest-only image behavior (tag == "", digest != null).
integration_tests/vulnerabilities.lua	Updates expectations to split tag vs digest in vulnerability summary responses.
integration_tests/k8s_resources/vulnerability/dev/slug-1/app.yaml	Keeps YAML document separator in the correct place while retaining tag+digest image input.
integration_tests/k8s_resources/vulnerability_digest_only/dev/slug-1/app.yaml	Adds digest-only workload resource fixture.
integration_tests/instance_groups.lua	Extends GraphQL selection/expectations to include digest for instance group images.

Files not reviewed (1)

• internal/graph/gengql/workloads.generated.go: Generated file

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• internal/graph/gengql/workloads.generated.go: Generated file